Cybersecurity
PHP warns of another unpatched RCE issue
PHP issued an advisory about a separate remote code execution issue two days after emergency fixes for two earlier flaws, and said the new problem affected only a narrow configuration.
- PHP published an informational advisory on 23 October about CVE-2026-115560.
- PHP said the issue could arise only when several specific configuration changes and a session upload progress feature were in use.
- The project did not issue an emergency patch and instead advised setting session.upload_progress.enabled=0 until the next routine release.
- No exploitation of CVE-2026-115560 had been reported, while Amazon and Cloudflare described heavy activity against CVE-2026-109618 and CVE-2026-109619.
PHP published a short advisory on 23 October about CVE-2026-115560. It said the flaw could let an attacker execute code on a web server, but only in a narrow setup.
According to the project, the problem depended on an application switching the session.serialize_handler setting at runtime with ini_set() before session_start() was called. It also required session upload progress to remain enabled.
PHP did not treat the issue as an emergency release. It advised turning off session.upload_progress.enabled until the next routine bugfix release and said the configuration was unlikely to be found in practice.
The project said it had not given affected versions, a severity score, or the release that would carry the fix. It also said no exploitation of CVE-2026-115560 had been reported.
Separate reporting covered attacks against the two earlier PHP2Shell flaws disclosed on 21 October. Amazon and Cloudflare said attempts against CVE-2026-109618 and CVE-2026-109619 increased rapidly after disclosure, while Sophos, Arctic Wolf, Previdian and Wordfence described attempts to scan, probe or install a Mirai variant.
Named in this story
Companies
- Amazon
- said its honeypots logged an exploit attempt before disclosure
- Cloudflare
- said exploit attempts rose sharply after disclosure
- Sophos
- said attackers tried to install a Mirai botnet variant
- Arctic Wolf
- said attackers tried to install a Mirai botnet variant
- Previdian
- reported scanning and probing but no confirmed code execution
- Wordfence
- reported scanning and probing but no confirmed code execution
Products and systems
- PHP
- issued the advisory and recommended disabling session upload progress
- CVE-2026-115560
- the new remote code execution issue in the advisory
- CVE-2026-109618
- one of the earlier PHP2Shell flaws patched on October 21
- CVE-2026-109619
- the other earlier PHP2Shell flaw patched on October 21
- session.upload_progress.enabled
- the setting PHP told users to turn off
- session upload progress
- the feature that had to remain enabled for the issue to arise
- session.serialize_handler
- the option involved in the vulnerable configuration
- ini_set()
- the function used to change that option at runtime
- Mirai
- the botnet variant attackers tried to deploy
How the source tells it
The article was written as a plain advisory, with limited urgency only in its reporting of exploit attempts against earlier flaws.
No emotive framing was found in the original.